eslint-plugin-jwt-security 2.3.0 → 2.3.2

package/dist/src/rules/require-expiration/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-expiration
- *
- * Mandates expiration claim (exp) or expiresIn option in JWT sign operations.
- * Tokens without expiration are valid forever, creating security risks.
- *
- * CWE-613: Insufficient Session Expiration
- *
- * @see https://tools.ietf.org/html/rfc8725
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { RequireExpirationOptions } from '../../types';
-type MessageIds = 'missingExpiration' | 'addExpiration';
-type RuleOptions = [RequireExpirationOptions?];
-export declare const requireExpiration: TSESLint.RuleModule<MessageIds, RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireExpiration;

package/dist/src/rules/require-expiration/index.js

@@ -1,136 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireExpiration = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.requireExpiration = (0, eslint_devkit_1.createRule)({
-    name: 'require-expiration',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/require-expiration.md',
-            description: 'Require expiration claim (exp) or expiresIn option in JWT signing',
-            cwe: 'CWE-613',
-            cvss: 5.4,
-        },
-        hasSuggestions: true,
-        messages: {
-            missingExpiration: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Missing JWT Expiration',
-                cwe: 'CWE-613',
-                description: 'JWT without expiration is valid forever, increasing exposure window',
-                severity: 'MEDIUM',
-                fix: 'Add expiresIn: "1h" or exp claim to payload',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-            addExpiration: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.INFO,
-                issueName: 'Add Expiration',
-                description: 'Add expiration to limit token lifetime',
-                severity: 'LOW',
-                fix: 'jwt.sign(payload, secret, { expiresIn: "1h" })',
-                documentationLink: 'https://www.npmjs.com/package/jsonwebtoken',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    maxExpirationSeconds: {
-                        type: 'integer',
-                        default: 86400,
-                        description: 'Maximum allowed expiration time in seconds (24h default)',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            maxExpirationSeconds: 86400,
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        /**
-         * Check if payload contains exp claim
-         */
-        // oxlint-disable-next-line consistent-function-scoping
-        const payloadHasExp = (payloadNode) => {
-            if (payloadNode.type !== 'ObjectExpression') {
-                return false;
-            }
-            return payloadNode.properties.some((prop) => prop.type === 'Property' &&
-                prop.key.type === 'Identifier' &&
-                prop.key.name === 'exp');
-        };
-        return {
-            CallExpression(node) {
-                // Only check sign operations
-                if (!(0, utils_1.isSignOperation)(node)) {
-                    return;
-                }
-                // Need at least payload argument
-                if (node.arguments.length < 1) {
-                    return;
-                }
-                const payloadArg = node.arguments[0];
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // Check if payload has exp claim
-                if (payloadHasExp(payloadArg)) {
-                    return;
-                }
-                // Check if options has expiresIn
-                if (optionsArg && (0, utils_1.hasOption)(optionsArg, 'expiresIn')) {
-                    return;
-                }
-                // Report missing expiration — suggest adding expiresIn to the options object
-                const optionsArg3 = node.arguments[2];
-                context.report({
-                    node,
-                    messageId: 'missingExpiration',
-                    suggest: [
-                        {
-                            messageId: 'addExpiration',
-                            fix(fixer) {
-                                const sourceCode = context.sourceCode;
-                                if (optionsArg3 && optionsArg3.type === eslint_devkit_1.AST_NODE_TYPES.ObjectExpression) {
-                                    // Options object exists but lacks expiresIn — insert property
-                                    const openBrace = sourceCode.getFirstToken(optionsArg3);
-                                    return fixer.insertTextAfter(openBrace, ' expiresIn: \'1h\',');
-                                }
-                                // No options arg — insert { expiresIn: '1h' } as third argument
-                                const lastArg = node.arguments[node.arguments.length - 1];
-                                return fixer.insertTextAfter(lastArg, ', { expiresIn: \'1h\' }');
-                            },
-                        },
-                    ],
-                });
-            },
-        };
-    },
-});
-exports.default = exports.requireExpiration;

package/dist/src/rules/require-issued-at/index.d.ts

@@ -1,23 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-issued-at
- *
- * Mandates the `iat` (issued at) claim in JWT tokens for freshness validation.
- * Without `iat`, tokens cannot be validated for age, enabling the
- * "Back to the Future" replay attack (LightSEC 2025).
- *
- * CWE-294: Authentication Bypass by Capture-replay
- *
- * @see https://securitypattern.com/post/jwt-back-to-the-future
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { JwtRuleOptions } from '../../types';
-type RuleOptions = [JwtRuleOptions?];
-export declare const requireIssuedAt: TSESLint.RuleModule<"missingIssuedAt", RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireIssuedAt;

package/dist/src/rules/require-issued-at/index.js

@@ -1,113 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireIssuedAt = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.requireIssuedAt = (0, eslint_devkit_1.createRule)({
-    name: 'require-issued-at',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/require-issued-at.md',
-            description: 'Require iat (issued at) claim for token freshness validation',
-            cwe: 'CWE-294',
-            cvss: 5,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            missingIssuedAt: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Missing Issued At Claim',
-                cwe: 'CWE-294',
-                description: 'JWT without iat claim cannot be validated for freshness, enabling replay attacks',
-                severity: 'MEDIUM',
-                fix: 'Add iat claim to payload or use library option that adds it automatically',
-                documentationLink: 'https://securitypattern.com/post/jwt-back-to-the-future',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        /**
-         * Check if payload contains iat claim
-         */
-        // oxlint-disable-next-line consistent-function-scoping
-        const payloadHasIat = (payloadNode) => {
-            if (payloadNode.type !== 'ObjectExpression') {
-                return false;
-            }
-            return payloadNode.properties.some((prop) => prop.type === 'Property' &&
-                prop.key.type === 'Identifier' &&
-                prop.key.name === 'iat');
-        };
-        return {
-            CallExpression(node) {
-                // Only check sign operations
-                if (!(0, utils_1.isSignOperation)(node)) {
-                    return;
-                }
-                // Need at least payload argument
-                if (node.arguments.length < 1) {
-                    return;
-                }
-                const payloadArg = node.arguments[0];
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // Check if payload has iat claim
-                if (payloadHasIat(payloadArg)) {
-                    return;
-                }
-                // Check if options has noTimestamp: false (meaning iat IS added)
-                // jsonwebtoken adds iat by default unless noTimestamp: true
-                if (optionsArg && (0, utils_1.hasOption)(optionsArg, 'noTimestamp')) {
-                    // If noTimestamp is explicitly set, we flag it (they're disabling iat)
-                    context.report({
-                        node: optionsArg,
-                        messageId: 'missingIssuedAt',
-                    });
-                    return;
-                }
-                // For explicit payload objects without iat we intentionally do not
-                // report — jsonwebtoken adds iat by default. (A dead empty `if` that
-                // re-checked !payloadHasIat(payloadArg) — always true after the early
-                // return above — was removed as unreachable-by-construction.)
-                // Note: jsonwebtoken adds iat by default, so we don't flag by default
-                // This rule primarily catches explicit noTimestamp: true usage
-            },
-        };
-    },
-});
-exports.default = exports.requireIssuedAt;

package/dist/src/rules/require-issuer-validation/index.d.ts

@@ -1,20 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-issuer-validation
- *
- * Mandates issuer (iss) claim validation in JWT verify operations.
- * Without issuer validation, tokens from any issuer are accepted.
- *
- * CWE-287: Improper Authentication
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { RequireIssuerValidationOptions } from '../../types';
-type RuleOptions = [RequireIssuerValidationOptions?];
-export declare const requireIssuerValidation: TSESLint.RuleModule<"missingIssuerValidation", RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireIssuerValidation;

package/dist/src/rules/require-issuer-validation/index.js

@@ -1,100 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireIssuerValidation = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.requireIssuerValidation = (0, eslint_devkit_1.createRule)({
-    name: 'require-issuer-validation',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/require-issuer-validation.md',
-            description: 'Require issuer (iss) claim validation in JWT verify operations',
-            cwe: 'CWE-287',
-            cvss: 9.8,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            missingIssuerValidation: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Missing Issuer Validation',
-                cwe: 'CWE-287',
-                description: 'JWT verification without issuer validation accepts tokens from any source',
-                severity: 'MEDIUM',
-                fix: 'Add issuer option: { issuer: "https://auth.example.com" }',
-                documentationLink: 'https://tools.ietf.org/html/rfc8725',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    knownIssuers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                        description: 'Known valid issuers to suggest',
-                    },
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            knownIssuers: [],
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        return {
-            CallExpression(node) {
-                if (!(0, utils_1.isVerifyOperation)(node)) {
-                    return;
-                }
-                if (node.arguments.length < 2) {
-                    return;
-                }
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // No options at all
-                if (!optionsArg) {
-                    context.report({
-                        node,
-                        messageId: 'missingIssuerValidation',
-                    });
-                    return;
-                }
-                // Check for issuer option
-                if (!(0, utils_1.hasOption)(optionsArg, 'issuer') && !(0, utils_1.hasOption)(optionsArg, 'iss')) {
-                    context.report({
-                        node: optionsArg,
-                        messageId: 'missingIssuerValidation',
-                    });
-                }
-            },
-        };
-    },
-});
-exports.default = exports.requireIssuerValidation;

package/dist/src/rules/require-max-age/index.d.ts

@@ -1,24 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * ESLint Rule: require-max-age
- *
- * Mandates maxAge option in JWT verify operations to enforce token freshness.
- * This prevents the "Back to the Future" replay attack where tokens are
- * captured and replayed months or years later.
- *
- * CWE-294: Authentication Bypass by Capture-replay
- *
- * @see https://securitypattern.com/post/jwt-back-to-the-future
- * @see LightSEC 2025 - "JWT Back to the future: On the (ab)use of JWTs"
- */
-import type { TSESLint } from '@interlace/eslint-devkit';
-import type { JwtRuleOptions } from '../../types';
-type RuleOptions = [JwtRuleOptions?];
-export declare const requireMaxAge: TSESLint.RuleModule<"missingMaxAge", RuleOptions, unknown, TSESLint.RuleListener> & {
-    name: string;
-};
-export default requireMaxAge;

package/dist/src/rules/require-max-age/index.js

@@ -1,93 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.requireMaxAge = void 0;
-const eslint_devkit_1 = require("@interlace/eslint-devkit");
-const utils_1 = require("../../utils");
-exports.requireMaxAge = (0, eslint_devkit_1.createRule)({
-    name: 'require-max-age',
-    meta: {
-        type: 'problem',
-        docs: {
-            url: 'https://github.com/ofri-peretz/eslint/blob/main/packages/eslint-plugin-jwt-security/docs/rules/require-max-age.md',
-            description: 'Require maxAge option in verify operations to enforce token freshness',
-            cwe: 'CWE-294',
-            cvss: 5,
-        },
-        fixable: undefined,
-        hasSuggestions: false,
-        messages: {
-            missingMaxAge: (0, eslint_devkit_1.formatLLMMessage)({
-                icon: eslint_devkit_1.MessageIcons.SECURITY,
-                issueName: 'Missing Token Age Validation',
-                cwe: 'CWE-294',
-                description: 'Without maxAge, tokens can be replayed long after issuance (Back to the Future attack)',
-                severity: 'MEDIUM',
-                fix: 'Add maxAge option: { maxAge: "1h" } to limit token lifetime',
-                documentationLink: 'https://securitypattern.com/post/jwt-back-to-the-future',
-            }),
-        },
-        schema: [
-            {
-                type: 'object',
-                properties: {
-                    trustedSanitizers: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    trustedAnnotations: {
-                        type: 'array',
-                        items: { type: 'string' },
-                        default: [],
-                    },
-                    strictMode: {
-                        type: 'boolean',
-                        default: false,
-                    },
-                },
-                additionalProperties: false,
-            },
-        ],
-    },
-    defaultOptions: [
-        {
-            trustedSanitizers: [],
-            trustedAnnotations: [],
-            strictMode: false,
-        },
-    ],
-    create(context) {
-        return {
-            CallExpression(node) {
-                if (!(0, utils_1.isVerifyOperation)(node)) {
-                    return;
-                }
-                if (node.arguments.length < 2) {
-                    return;
-                }
-                const optionsArg = (0, utils_1.getOptionsArgument)(node, 2);
-                // No options at all
-                if (!optionsArg) {
-                    context.report({
-                        node,
-                        messageId: 'missingMaxAge',
-                    });
-                    return;
-                }
-                // Check for maxAge option
-                if (!(0, utils_1.hasOption)(optionsArg, 'maxAge') && !(0, utils_1.hasOption)(optionsArg, 'clockTolerance')) {
-                    context.report({
-                        node: optionsArg,
-                        messageId: 'missingMaxAge',
-                    });
-                }
-            },
-        };
-    },
-});
-exports.default = exports.requireMaxAge;

package/dist/src/types/index.js

@@ -1,7 +0,0 @@
-"use strict";
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/utils/index.d.ts

@@ -1,98 +0,0 @@
-/**
- * Copyright (c) 2025 Ofri Peretz
- * Licensed under the MIT License. Use of this source code is governed by the
- * MIT license that can be found in the LICENSE file.
- */
-/**
- * Shared utilities for JWT security rules
- *
- * Library detection, pattern matching, and common helpers.
- */
-import type { TSESTree } from '@interlace/eslint-devkit';
-/**
- * Supported JWT libraries
- */
-export declare const JWT_LIBRARIES: {
-    readonly JSONWEBTOKEN: "jsonwebtoken";
-    readonly JOSE: "jose";
-    readonly EXPRESS_JWT: "express-jwt";
-    readonly NESTJS_JWT: "@nestjs/jwt";
-    readonly JWKS_RSA: "jwks-rsa";
-    readonly JWT_DECODE: "jwt-decode";
-};
-export type JwtLibrary = (typeof JWT_LIBRARIES)[keyof typeof JWT_LIBRARIES];
-/**
- * Insecure algorithms that should be flagged
- */
-export declare const INSECURE_ALGORITHMS: Set<string>;
-/**
- * Algorithms vulnerable to confusion attacks when used with asymmetric keys
- */
-export declare const SYMMETRIC_ALGORITHMS: Set<string>;
-/**
- * Recommended secure algorithms
- */
-export declare const SECURE_ALGORITHMS: Set<string>;
-/**
- * Sensitive field names that should not be in JWT payload
- * All lowercase for case-insensitive matching
- */
-export declare const SENSITIVE_PAYLOAD_FIELDS: Set<string>;
-/**
- * JWT method patterns for different operations
- */
-export declare const JWT_METHODS: {
-    readonly SIGN: Set<string>;
-    readonly VERIFY: Set<string>;
-    readonly DECODE: Set<string>;
-};
-/**
- * Check if a node represents a call to a JWT library method
- */
-export declare function isJwtLibraryCall(node: TSESTree.CallExpression, targetMethods: Set<string>): boolean;
-/**
- * Check if a node is a string literal with a specific value
- */
-export declare function isStringLiteral(node: TSESTree.Node, value?: string): node is TSESTree.Literal;
-/**
- * Extract algorithm from options object
- */
-export declare function extractAlgorithms(optionsNode: TSESTree.ObjectExpression): string[];
-/**
- * Check if options object has a specific property set
- */
-export declare function hasOption(optionsNode: TSESTree.ObjectExpression, optionName: string): boolean;
-/**
- * Get the value of a specific option from options object
- */
-export declare function getOptionValue(optionsNode: TSESTree.ObjectExpression, optionName: string): TSESTree.Node | undefined;
-/**
- * Check if a literal appears to be a weak secret (short string)
- */
-export declare function isWeakSecret(node: TSESTree.Node, minLength?: number): boolean;
-/**
- * Check if a node is an environment variable access (safe pattern)
- */
-export declare function isEnvVariable(node: TSESTree.Node): boolean;
-/**
- * Check if this call looks like a JWT sign operation
- */
-export declare function isSignOperation(node: TSESTree.CallExpression): boolean;
-/**
- * Check if this call looks like a JWT verify operation
- */
-export declare function isVerifyOperation(node: TSESTree.CallExpression): boolean;
-/**
- * Check if this call looks like a JWT decode operation (no verification)
- */
-export declare function isDecodeOperation(node: TSESTree.CallExpression): boolean;
-/**
- * Get the options argument from a JWT call
- * For jwt.verify(token, secret, options) -> returns options
- * For jwt.sign(payload, secret, options) -> returns options
- */
-export declare function getOptionsArgument(node: TSESTree.CallExpression, optionsIndex?: number): TSESTree.ObjectExpression | undefined;
-/**
- * Check if file is a test file
- */
-export declare function isTestFile(filename: string): boolean;